chore(nix): add flake.nix + bun.lock so 9router builds/deploys from this repo

Migrate the Nix build + deploy source from /home/code/9router-repo (a pure
upstream mirror, now deleted) to this repo, which carries the MIBP fork
merge (freebuff, cline free models, proxy-pool fitness). flake.lock and
flake.nix copied verbatim from 9router-repo; bun.lock generated from the
merged dependency set. The cron updater (9router-update.sh) now points at
/home/code/9router with a keep-ours conflict policy.

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1785301185,
+        "narHash": "sha256-eoS3KQTO0aPWXZvIaRbRAzSSHW3l5wdMFXtT1ISfoKA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9bc02893134c733dd85de46ee4fb2fac696b5529",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,93 @@
+{
+  description = "9Router — AI routing gateway + Next.js dashboard (Nix build)";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          overlays = [
+            (self: super: {
+              bun = super.bun.overrideAttrs (old: rec {
+                version = "1.4.0";
+                src = super.fetchzip {
+                  url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip";
+                  sha256 = "sha256:Poy0vf7yJ/hzk33QiQj5gnshI5Q7dfbaMD7xgwiyDKw=";
+                };
+              });
+            })
+          ];
+        };
+        nodejs = pkgs.nodejs_22;
+      in {
+        packages.default = pkgs.stdenv.mkDerivation {
+          pname = "9router";
+          version = "0.5.86";
+          src = ./.;
+
+          nativeBuildInputs = [
+            pkgs.bun
+            pkgs.git
+            pkgs.python3
+            pkgs.gnumake
+            pkgs.gcc
+            pkgs.cacert
+            pkgs.makeBinaryWrapper
+          ];
+
+          buildPhase = ''
+            export HOME=$TMPDIR/home
+            export npm_config_cache=$TMPDIR/npm-cache
+            mkdir -p "$npm_config_cache" "$HOME"
+
+            # SSL/TLS certs (Nix sandbox doesn't have system CA bundle)
+            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+            export NODE_EXTRA_CA_CERTS=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+
+            echo "=== bun install ==="
+            bun install 2>&1
+
+            echo "=== bun run build (next build --webpack) ==="
+            bun run build 2>&1
+
+            echo "=== Build complete ==="
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin $out/lib/9router
+
+            # Next.js standalone output (self-contained server + traced node_modules)
+            cp -r .next/standalone/* $out/lib/9router/
+            # Full node_modules from bun install — standalone trace can miss deps
+            # (e.g. undici for /v1/chat executor); overwrite traced subset
+            rm -rf $out/lib/9router/node_modules
+            cp -r node_modules $out/lib/9router/node_modules
+            # Full .next build (BUILD_ID, server chunks, static) — standalone output
+            # may omit it depending on Next version; the server requires it at runtime
+            cp -r .next $out/lib/9router/.next
+            rm -rf $out/lib/9router/.next/cache $out/lib/9router/.next/standalone
+            # Runtime engine + source dirs the standalone server traces/fetches
+            cp -r open-sse $out/lib/9router/open-sse 2>/dev/null || true
+            cp -r src $out/lib/9router/src 2>/dev/null || true
+            # Public assets
+            cp -r public $out/lib/9router/public 2>/dev/null || true
+            # Custom server (IP derivation, header sanitisation)
+            cp custom-server.js $out/lib/9router/custom-server.js
+
+            # Wrapper — cd into lib dir so process.cwd() resolves (Drizzle/relative lookups)
+            cat > $out/bin/9router << WRAPPER
+#!${pkgs.runtimeShell}
+export PATH=${nodejs}/bin:\$PATH
+cd $out/lib/9router
+exec ${nodejs}/bin/node custom-server.js
+WRAPPER
+            chmod +x $out/bin/9router
+          '';
+        };
+      });
+}